Daraja sandbox to production: the checklist nobody publishes

Safaricom's docs say "Apply for Go Live" and stop there. The application form rejects 60 percent of first-time submissions for reasons the form never explains. This is the pre-flight checklist we run for every Angazé client moving from sandbox to live M-Pesa.

Before you click "Go Live"

1. You need a real Paybill or Till number

Sandbox lets you use shortcode 174379 for everyone. Production demands your own. Apply through Safaricom Business (not Daraja). Cost: ~KES 1,800 setup, ~KES 100 per month for a Paybill; Tills are free monthly but charge a higher per-transaction fee.

2. Your business is registered and verifiable

You need:

• Business name registration certificate (sole prop) or CR12 (limited)
• KRA PIN certificate
• Director's national ID copy
• A clear logo (PNG, 1024 x 1024 minimum)

3. Your website is reachable, secure, and complete

Daraja's reviewers spot-check your website. They reject submissions from sites that:

• Use HTTP instead of HTTPS
• Have a parking page or "Coming Soon"
• Have no Privacy Policy linked from the footer
• Have no Refund Policy (mandatory for M-Pesa merchants)
• Have no clear product or service description

Angazé sites ship with /privacy, /terms, and /refund by default precisely for this reason.

4. Your callback URL is publicly reachable HTTPS

Test it. Curl it from outside your office network. If it returns anything other than 200 from a public IP, the application gets rejected.

5. Your callback handler returns 200 even on failed payments

A common bug: you return 500 when the customer cancels. Daraja sees an unreachable callback and disables your app. Always return { ResultCode: 0, ResultDesc: "Accepted" }.

The application flow

1. In Daraja portal, open your sandbox app, scroll to "Production Credentials". Click "Go Live".
2. Upload: business registration, KRA PIN, director ID, logo.
3. Provide: business website URL, callback URL, business contact email, business contact phone.
4. Link the Paybill or Till to the production app. You may need to contact Safaricom Business support to authorize the linkage if you got your shortcode separately.
5. Wait. Daraja emails you when approved. Production credentials appear in the same dashboard.

Switching your code

Four things change between sandbox and production:

1. Base URL: api.safaricom.co.ke (no "sandbox.")
2. Consumer Key and Consumer Secret: production-specific
3. Passkey: production-specific, unique to your shortcode
4. Shortcode: your real Paybill or Till

That is the whole code change. Same protocol, same request shape, same callback structure.

In Vercel: open Project → Settings → Environment Variables, update the five values, redeploy. Real money now flows on the same checkout flow you tested in sandbox.

The first transaction

Use your own phone with a real M-Pesa balance. Send yourself KES 1. Receive an STK prompt. Enter PIN. Money moves to your Paybill (visible on Safaricom Business portal). You also receive an SMS receipt. Callback fires. Your database marks the order paid.

Save that first M-Pesa receipt. It is the screenshot that goes on your Twitter when you announce you are live.

Where Angazé fits

Every Angazé Care client gets the Daraja production migration included. We sit with you for the 20 minutes the form takes, fix every rejection reason in advance, and verify the first live transaction together. Send us a message with your sandbox app name and we will quote the migration alone if you do not need a full build.